Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add RockyHong/super-bootstrap --skill triage-reportgit clone --depth 1 https://github.com/RockyHong/super-bootstrapWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rockyhong/super-bootstrap/triage-report)<a href="https://agentmods.dev/skills/rockyhong/super-bootstrap/triage-report"><img src="https://agentmods.dev/badge/skills/rockyhong/super-bootstrap/triage-report/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rockyhong/super-bootstrap/triage-report"><img src="https://agentmods.dev/badge/skills/rockyhong/super-bootstrap/triage-report.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00151 | $0.00842 |
| Opus 5 | $0.00076 | $0.00421 |
| Sonnet 5 | $0.00030 | $0.00168 |
| Haiku 4.5 | $0.00015 | $0.00084 |
Grade A, and why
triage-report scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 40 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Triage Report — Review-Queue Drain
The scanner answered is this hit real by its own rule; this lane answers is it worth acting on, and where does it route. Producer-agnostic — fires on artifact presence in .review/, regardless of which scanner wrote the report. The thinking runs in the triage-report subagent (agents/triage-report.md, model: sonnet); this skill is the dispatch shell + absorption protocol.
Target resolution
Argument is an optional report path. Without one, resolve from the queue — the directory IS the queue:
.review/*.md glob |
Behavior |
|---|---|
| 0 reports | Report "review queue clean", exit. |
| 1 report | Dispatch it. |
| N reports | Sequential, oldest-first — one dispatch per report. Later runs dedup against the cards earlier runs just promoted; never merge reports into one dispatch. |
Execution — per report
- Dispatch:
Agenttool,subagent_type: "triage-report", prompt = the report path + scan date if known. Nothing else — no gateway priors on which findings matter. - Review the sheet (gateway): coverage line must hold (findings = verdicts). Dismiss is the lossy verdict — a dismissal whose rationale doesn't beat the scanner's stated reasoning bounces back as
needs-investigation. - Absorb:
- promote → one batched
/super-bootstrap:logpass carrying the agent's draft claim blocks. Rows land raw; the pipeline rolls at normal pickup. - patch → doc-mechanical edits only, landed per CLAUDE.md § Dispatch (gateway inline, or dispatched by closure). Anything wider re-verdicts as promote.
- dup → fold any new-fact into the
/super-bootstrap:logbatch — rides the log door's amend path (dedup surfaces for the user's pick; the Amendment lands on the owning card). - needs-investigation → the single question rides
/super-bootstrap:triagewhen it names a card; otherwise an investigate-only probe dispatch. Verdicts return to step 2.
- promote → one batched
- Close out — only after every finding holds a terminal verdict and every patch has landed: delete the report; the deletion + a dispositions summary ride the session's envelope commit (dismissal rationales survive in git log).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 40 lines · 151 tokens per session scan A d23b5c51a0d0
triage-report is a skill published in the GitHub repository RockyHong/super-bootstrap (3 stars, last pushed today), licensed MIT. It adds 151 tokens to every session and 842 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ln-11-plan-reviewer
Reviews an implementation plan against repository evidence before execution; identifies missing decisions and risks. Not for completed-code review.
ln-12-delivery-reviewer
Reviews a completed change for regressions, unmet acceptance, and release risks. Not for whole-codebase audits or repairs.
ln-22-codebase-auditor
Audits cross-cutting code health, security, delivery, and maintainability when no specialist audit is primary. Not for a single delivery review.
ln-23-test-suite-auditor
Audits existing tests for meaningful coverage, trustworthy oracles, and maintenance value. Not for test implementation or a single delivery review.
ln-21-documentation-auditor
Audits documentation and comments for trustworthy claims, coverage, and discoverability. Not for code, test, or architecture audits.
ln-24-architecture-auditor
Audits implemented architecture, boundaries, dependencies, and configuration ownership. Not for documenting current state or reviewing plans.